
hook.o:     file format elf32-littlearm


Disassembly of section .text:

00000000 <null_func>:
#include <sys/personality.h>

void (*aaa)();

void null_func()
{
   0:	e92d4800 	push	{fp, lr}
   4:	e28db004 	add	fp, sp, #4
	printf("THIS is NULL!!!\n");
   8:	e59f0004 	ldr	r0, [pc, #4]	; 14 <null_func+0x14>
   c:	ebfffffe 	bl	0 <puts>
}
  10:	e8bd8800 	pop	{fp, pc}
  14:	00000000 	.word	0x00000000

00000018 <map_and_call_null>:

void map_and_call_null()
{
  18:	e92d4800 	push	{fp, lr}
  1c:	e28db004 	add	fp, sp, #4
  20:	e24dd010 	sub	sp, sp, #16
	char *addr = NULL;
  24:	e3a03000 	mov	r3, #0
  28:	e50b3008 	str	r3, [fp, #-8] ; addr

	addr = mmap(0, 0x1000, PROT_READ|PROT_WRITE|PROT_EXEC,MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
  2c:	e3a03000 	mov	r3, #0         ; r3 = 0
  30:	e58d3004 	str	r3, [sp, #4]   ; r3 = [sp -4]
  34:	e3a03000 	mov	r3, #0         ; r3 = 0
  38:	e58d3000 	str	r3, [sp]       ; sp = 0
  3c:	e3a03032 	mov	r3, #50	; 0x32   r3 = 50
  40:	e3a02007 	mov	r2, #7         ; r2 = 7
  44:	e3a01a01 	mov	r1, #4096	; 0x1000    r1 = 4096
  48:	e3a00000 	mov	r0, #0
  4c:	ebfffffe 	bl	0 <mmap>
  50:	e50b0008 	str	r0, [fp, #-8] ;  addr
	addr[0] = '\xff';
  54:	e51b3008 	ldr	r3, [fp, #-8] ; addr
  58:	e3e02000 	mvn	r2, #0        ; r2 = 0
  5c:	e5c32000 	strb	r2, [r3]  ; addr
	addr[1] = '\x25';
  60:	e51b3008 	ldr	r3, [fp, #-8] ; addr
  64:	e2833001 	add	r3, r3, #1    ; addr + 1
  68:	e3a02025 	mov	r2, #37	; 0x25
  6c:	e5c32000 	strb	r2, [r3] ; addr
	*(unsigned int *)&addr[2] = 6;
  70:	e51b3008 	ldr	r3, [fp, #-8] ; addr 
  74:	e2833002 	add	r3, r3, #2    ; addr + 2
  78:	e3a02006 	mov	r2, #6        ; r2 = 6
  7c:	e5832000 	str	r2, [r3]      ; addr+2 = 6
	*(unsigned long *)&addr[6] = (unsigned long)&null_func;
  80:	e51b3008 	ldr	r3, [fp, #-8]                     ; addr
  84:	e2833006 	add	r3, r3, #6                        ; addr + 6
  88:	e59f206c 	ldr	r2, [pc, #108]	; fc <map_and_call_null+0xe4>
  8c:	e5832000 	str	r2, [r3]        ; addr[6]
	aaa = NULL; //...NULL
  90:	e59f3068 	ldr	r3, [pc, #104]	; 100 <map_and_call_null+0xe8>  aaa
  94:	e3a02000 	mov	r2, #0
  98:	e5832000 	str	r2, [r3]      ; aaa
	(*aaa)();
  9c:	e59f305c 	ldr	r3, [pc, #92]	; 100 <map_and_call_null+0xe8>
  a0:	e5933000 	ldr	r3, [r3]
  a4:	e12fff33 	blx	r3

	int *empty = NULL;
  a8:	e3a03000 	mov	r3, #0
  ac:	e50b300c 	str	r3, [fp, #-12] ; empty
	printf("1 %x\n",*empty);
  b0:	e51b300c 	ldr	r3, [fp, #-12]
  b4:	e5933000 	ldr	r3, [r3]
  b8:	e1a01003 	mov	r1, r3
  bc:	e59f0040 	ldr	r0, [pc, #64]	; 104 <map_and_call_null+0xec>
  c0:	ebfffffe 	bl	0 <printf>
	printf("2 %x\n",*(empty+1));
  c4:	e51b300c 	ldr	r3, [fp, #-12] ; empty
  c8:	e2833004 	add	r3, r3, #4     ; empty+4
  cc:	e5933000 	ldr	r3, [r3]       ; r3 = empty
  d0:	e1a01003 	mov	r1, r3         ; r1 = empty
  d4:	e59f002c 	ldr	r0, [pc, #44]	; 108 <map_and_call_null+0xf0>
  d8:	ebfffffe 	bl	0 <printf>
	printf("3 %x\n",*(empty+2));
  dc:	e51b300c 	ldr	r3, [fp, #-12]
  e0:	e2833008 	add	r3, r3, #8
  e4:	e5933000 	ldr	r3, [r3]
  e8:	e1a01003 	mov	r1, r3
  ec:	e59f0018 	ldr	r0, [pc, #24]	; 10c <map_and_call_null+0xf4>
  f0:	ebfffffe 	bl	0 <printf>
}
  f4:	e24bd004 	sub	sp, fp, #4
  f8:	e8bd8800 	pop	{fp, pc}
	...
 104:	00000010 	.word	0x00000010
 108:	00000018 	.word	0x00000018
 10c:	00000020 	.word	0x00000020

00000110 <main>:

int main()
{
 110:	e92d4800 	push	{fp, lr}
 114:	e28db004 	add	fp, sp, #4
	map_and_call_null();
 118:	ebfffffe 	bl	18 <map_and_call_null>
}
 11c:	e1a00003 	mov	r0, r3
 120:	e8bd8800 	pop	{fp, pc}
